ABSTRACT
Introduction The “mitigating controls” assessment instrument (henceforth the MCI) is used to evaluate the security and privacy practices of a data requestor (the requestor) from a custodian (the custodian). This information is critical for evaluating the overall risk to the custodian of disclosing the data to the requestor, and drives the amount of de-identification that needs to be applied to the data before they may be disclosed. The purpose of this chapter is to describe the workings of the MCI.
